The ISIS Twitter CensusDefining and describing the population of ISIS supporters on Twitter

(1)

The ISIS Twitter Census

Defining and describing the population of ISIS supporters on Twitter

By J.M. BeRgeR AND

JoNAThoN MoRgAN

(2)

1 1 2 5 6

8 9 10 12 14 15 16 18 19 20 21 23 24 26 27 28 30 32 32 33 33 34 34 36

39 40 41 42 43 44 45 47 50

51 52

54 55

58 59 61 62 62 63 64 65 The Authors

The Research Team Executive Summary Introduction

1. Demographics of ISIS Supporters 1.1 Estimating the Total Number of Supporters

1.2 The Demographics Dataset 1.3 Data Snapshot

1.4 Location

1.4.1 Inferred Location 1.5 Languages

1.6 Display Names

1.7 Date of Account Creation 1.8 Date of Last Recorded Tweet 1.9 Avatars

1.10 Top Hashtags 1.11 Top Links

1.12 “Official” Accounts 1.13 Bots and Apps 1.14 Smartphones 2. Social Media Metrics 2.1 Tweeting patterns 2.2 Number of Followers

2.3 Number of Accounts Followed 2.4 Follower/Following Ratio 2.5 Suspensions

2.5.1 Number of observed suspensions

2.5.2 Suspensions of accounts created in September and October 2014 2.5.3 Performance of accounts that were not suspended

2.5.4 Partial comparison data

3. Methodology 3.1 Starting Point

3.2 Challenges and Caveats 3.3 Bot and Spam Detection 3.4 Description of Data Collected 3.5 Data Codebook

3.6 Sorting Metrics

3.7 Metrics Performance and Estimates 3.8 Machine Learning Approach to Level 2 Results

3.8.1 Predicting Supporters 4. Conclusions: Pros and Cons of

Suspending ISIS Supporters on Twitter 4.1 Intelligence Value

4.2 Effectiveness of Suspensions in Limiting ISIS’s Influence 4.3 Suspensions and Trade-offs

4.4 Preliminary Policy Recommendations 4.5 Research recommendations

Appendices

A) Notes on In-Network Calculations B) Control Group

About the Project on U.S. Relations with the Islamic World

The Center for Middle East Policy

(3)

The Authors The Research Team

J.M. Berger

J.M. Berger is a nonresident fellow with the Project on U.S. Relations with the Islamic World at Brook- ings and the author of Jihad Joe: Americans Who Go to War in the Name of Islam (Potomac Books, 2011) and ISIS: The State of Terror (Ecco, 2015). An ana- lyst and consultant studying extremism, he is also involved with developing analytical techniques to study political and extremist uses of social media. He is a regular contributor to Foreign Policy and the founder of Intelwire.com.

Jonathon Morgan

Jonathon is a technologist, data scientist, and startup veteran. He runs technology and product develop- ment at CrisisNET, Ushahidi’s streaming crisis data platform, and consults on machine learning and network analysis. Morgan is also co-host of Partially De- rivative, a popular data science podcast.

Prior to Ushahidi, Morgan served as the CTO of SA Trails, a venture-backed startup with operations across South America. He was Principal Technologist at Bright & Shiny, where he led the team that realized scientist David Gelertner’s vision of personalized data streams (“lifestreams”). Previously, Morgan served as CEO of StudentPositive, an education technology company focused on predicting student behavior.

J.M. Berger and Jonathon Morgan designed and implemented collection and analysis techniques using proprietary code, supplemented by a limited number of third-party tools. Berger, Youssef ben Ismail, and Heather Perez coded accounts. Perez also contributed essential data points pertaining to ISIS’s social network strategy. J.M. Berger wrote the report.

Special thanks are due to Will McCants, Anne Peckham, and Kristine Anderson of the Brookings Institution; Yasmin Green, Jana Levene, and Justin Kosslyn of Google Ideas; and Jessica Stern, Chris Albon, Dan Sturtevant, and Bill Strathearn.

This paper was commissioned by Google Ideas and published by the Brookings Institution. The views expressed herein represent those of the authors alone.

(4)

The Islamic State, known as ISIS or ISIL, has ex- ploited social media, most notoriously Twitter, to send its propaganda and messaging out to the world and to draw in people vulnerable to radicalization.

By virtue of its large number of supporters and highly organized tactics, ISIS has been able to exert an outsized impact on how the world per- ceives it, by disseminating images of graphic vio- lence (including the beheading of Western jour- nalists and aid workers and more recently, the immolation of a Jordanian air force pilot), while using social media to attract new recruits and in- spire lone actor attacks.

Although much ink has been spilled on the topic of ISIS activity on Twitter, very basic questions remain unanswered, including such fundamental is- sues as how many Twitter users support ISIS, who they are, and how many of those supporters take part in its highly organized online activities.

Previous efforts to answer these questions have relied on very small segments of the overall ISIS social network. Because of the small, cellular nature of that network, the examination of particular subsets such as foreign fighters in relatively small numbers, may create misleading conclusions.

The information vacuum extends to—and is par- ticularly acute within—the sometimes heated discussion of how the West should respond to this online campaign.

While there are legitimate debates about the bounds of free speech and the complex relationship between private companies and the public interest, some have argued against suspending terrorist social media accounts on the basis that suspensions are not effective at impeding extremist activity online. These arguments that are usually predicated

on very small samples of potentially misleading data, when data is proffered at all.

We set out to answer some of these important questions using innovative techniques to create a large, representative sample of accounts that can be clearly defined as ISIS supporters, and to attempt to de- fine the boundaries of ISIS’s online social network.

The goals of the project included:

• Create a demographic snapshot of ISIS supporters on Twitter using a very large and accurate sample of accounts (addressed in sections 1 and 2 of this paper).

• Outline a methodology for discovering and defining relevant accounts, to serve as a basis for future research using consistent comparison data (section 3).

• Create preliminary data and a path to further investigate ISIS-supporting accounts suspended by Twitter and the effects of suspensions (section 2.5).

Our findings, based on a sample of 20,000 ISIS supporter accounts, include:

• From September through December 2014, we estimate that at least 46,000 Twitter accounts were used by ISIS supporters, although not all of them were active at the same time.

• The 46,000 figure is our most conservative estimate for this time frame. Our maximum estimate is in the neighborhood of 70,000 accounts; however, we believe the truth is closer to the low end of the range (sections 1.1, 3.5, 3.6, 3.8).

• Typical ISIS supporters were located within the organization’s territories in Syria and Iraq, as well as in regions contested by ISIS. Hundreds of ISIS-supporting accounts sent tweets with location metadata embedded (section 1.4).

Executive Summary

(5)

• Almost one in five ISIS supporters selected Eng- lish as their primary language when using Twit- ter. Three quarters selected Arabic (section 1.5).

• ISIS-supporting accounts had an average of about 1,000 followers each, considerably higher than an ordinary Twitter user. ISIS-supporting accounts were also considerably more active than non-supporting users (section 2).

• Much of ISIS’s social media success can be attributed to a relatively small group of hyperac- tive users, numbering between 500 and 2,000 accounts, which tweet in concentrated bursts of high volume (section 2.1).

• A minimum of 1,000 ISIS-supporting accounts were suspended between September and Decem- ber 2014, and we saw evidence of potentially thousands more. Accounts that tweeted most often and had the most followers were most likely to be suspended (section 2.5.1).

• At the time our data collection launched in Sep- tember 2014, Twitter began to suspend large numbers of ISIS-supporting accounts. While this prevented us from creating a pre-suspension dataset, we were able to gather information on how the removal of accounts affected the overall network (section 2.5.4).

• Account suspensions do have concrete effects in limiting the reach and scope of ISIS activities on social media. They do not, at the current level of implementation, eliminate those activities, and cannot be expected to do this. Some critics argue suspensions are ineffective because ISIS propaganda is still available on Twitter. Any bal- anced evaluation of current levels of suspension activity clearly demonstrates that total interdic- tion is not the goal. The qualitative debate is over how suspensions affect the performance of the network and whether a different level of pressure might produce a different result (sections 2.5, 4.2). While it is possible to target suspensions in a manner that would be far more devastating to ISIS networks, we do not advise such an approach for several reasons (sections 4.1 and 4.3).

• The process of suspension does create certain new risks. Most importantly, while suspensions appear to have created obstacles to supporters join-

ing ISIS’s social network, they also isolate ISIS supporters online. This could increase the speed and intensity of radicalization for those who do manage to enter the network, and hinder organic social pressures that could lead to deradicaliza- tion (section 4.3).

• Further study is required to evaluate the unin- tended consequences of suspension campaigns and their attendant trade-offs. Fundamentally, tampering with social networks is a form of social engineering, and acknowledging this fact raises many new, difficult questions (section 4.3).

• Social media companies and the U.S government must work together to devise appropriate re- sponses to extremism on social media. Although discussions of this issue often frame government intervention as an infringement on free speech, in reality, social media companies currently regu- late speech on their platforms without oversight or disclosures of how suspensions are applied (section 4.4). Approaches to the problem of extremist use of social media are most likely to succeed when they are mainstreamed into wider dialogues among the wide range of community, private, and public stakeholders.

(6)

Links among the top 500 Twitter accounts as sorted by the in-group metric used to identify ISIS supporters.

Red lines indicate reciprocal relationships.

(7)

Introduction

This study consists of four parts:

• ISIS supporter demographics

• ISIS supporter social media metrics

• A detailed discussion of the methodology used for this paper

• A preliminary examination of the effects of suspending social media accounts and recommendations for further study and policies

The first two sections are based on a sample of 20,000 accounts believed to be comprised of at least 93 percent ISIS supporters. We examine where these supporters are located, what languages they speak, what identifying information they provide, when their accounts were created, a limited view on what content they post, and the methods they use to spread ISIS propaganda and recruit followers around the globe.

The third section discusses in considerable detail how we identified these accounts. We believe this is a crucial part of the discussion, to allow readers to determine how much confidence to place in the results, and to establish a framework for future research on the performance of social networks.

The fourth section discusses some of the impli- cations and questions raised by this study, par- ticularly pertaining to the effects of suspending extremist social media accounts. This section also points to some of the challenges of design- ing a coherent approach among all stakeholders involved in countering the problem of violent extremism on social media.

(8)

1. Demographics

of ISIS Supporters

Who are the users supporting ISIS on Twitter?

Where do they live, and how do they do their work online? These are questions of great importance for anyone trying to understand the scope of the problem and possible remedies.

Using a variety of innovative approaches, we identified an accurate dataset of 20,000 ISIS supporter accounts on Twitter. Through this sample we aimed to estimate the total number of accounts supporting ISIS on Twitter and to create a demographic profile of this group, shedding light on where users are based, what languages they speak, what they tweet about, and how they access the Internet.

The demographics data, as well as the Twitter metrics discussed in section 2, also shed light on the social media strategies ISIS uses to disseminate its messages online.

(9)

1.1 Estimating the Total Number of Supporters

We had hoped to establish both a floor and a ceiling for estimates of the size of ISIS’s supporter base on Twitter. A completely reliable ceiling proved elusive due to the size of the dataset, its rapid evolu- tion, and the complexity of the relationships within it. However we were able to establish a floor with reasonable certainty.

During the period of October 4 through Novem- ber 27, 2014, we estimate there were no fewer than 46,000 Twitter accounts supporting ISIS. Some accounts that were active in September but subsequently suspended were relevant to the set, and different kinds of information were collected at different speeds based on Twitter API limits. This figure excludes deceptive tactics meant to inflate ISIS’s Twitter following, such as automated bots, but includes multiple accounts maintained by human users.

This estimate was derived from two sources of data:

• We collected extremely robust data on nearly 50,000 accounts. We estimate that a minimum of 30,000 of these are accurately described as accounts belonging to ISIS supporters and controlled by a human user, using the most conservative criteria. We have a high level of confidence in this estimate, which is based on samples coded under the criteria described in section 3.5 and the metrics described in sections 3.6 and 3.7.

• We also collected partial data on 1.9 million additional accounts, as described in 3.8. Because this data was incomplete, it proved difficult to craft a firm estimate, but we believe a minimum of 16,000 additional supporters are contained in that set. With caveats, we estimate a hard ceiling for ISIS supporters in the vicinity of 90,000 accounts; we could not establish a definitive upper limit. Based on anecdotal observation, we suspect the true number does not approach this level;

however the metrics described in section 3.8 allow for this possibility.

All data in this paper pertains to specific ranges of time when the data was collected, from October 4 through November 27, 2014, with some seed data retrieved in September 2014. Thousands of accounts were suspended and created throughout the period of data collection. Therefore this estimate does not reflect the exact user base of ISIS at any specific moment, but rather reflects activity on a rolling basis. The user base at any given moment was likely smaller than the total estimate of 46,000.

The only way to capture a snapshot over a more condensed time frame would involve either directly accessing data, with permission, from within Twit- ter’s own systems, or violating Twitter’s terms of service regarding the speed of access of data. These options were respectively unavailable and undesir- able.

When coding samples, we adopted a very conservative regimen, detailed below, which likely under- estimates the amount of support for ISIS in the dataset by emphasizing overt support and excluding ambiguous classes of accounts. There are three ambiguous classes of account that should be considered when evaluating these results:

• Covert supporters of ISIS: Users who took me- dium to strong steps to conceal their support due to fear of prosecution or suspension by Twitter.

Users who took only casual steps to disguise their support were generally detectable.

• Pro-ISIS intelligence operatives: Some users who follow accounts related to the enemies of ISIS, such as rival jihadists, would be coded as non-supporters under the conservative criteria we employed.

• Anti-ISIS intelligence operatives: These are ac- counts created to appear as ISIS supporters in order to allow ISIS’s enemies to monitor its activities, which would be coded as supporters (if done effectively).

After reviewing hundreds of accounts in the set—

with a focus on those that appeared ambiguous—

we believe a significant number of accounts in the Demographics Dataset fall into the first two

(10)

(see sections 1.13 and 3.3)

This first round of eliminations left us with 43,538 accounts. We identified a set of 20,000 accounts, of which we estimate more than 93 percent are ISIS supporters, with a margin of er- ror of about +/- 2.54 percent. This set of 20,000 accounts, the “Demographics Dataset,” was used to produce the descriptive analysis in this section, except where explicitly noted.

supporters. We did not develop a methodology to evaluate the third category, and the number of potentially relevant users remains unknown.

Several variations of our identification methodology produced extremely similar results in the top 20,000 accounts, adding to our confidence in the integrity of the sample. The final metric was more effective at lower ranges as well.

The number of supporters has certainly changed since the data was collected; we provide data on more recent changes in section 2.5.4.

1.2 The Demographics Dataset

After determining the estimated total number of ISIS-supporting accounts, we sought to describe a representative sample as completely as possible.

Because the quantity of data analyzed was too large to allow for an individual review of every single account, we had to sort ISIS supporters from non- supporters among accounts for which we had robust data.

Non-supporter accounts in the data collected included enemies of ISIS, non-ISIS jihadis, people tracking the organization’s activities (such as jour- nalists and researchers), and accounts for online services used by ISIS supporters, such as @YouTube or @Twitter.

Using metrics described in section 3.6, we sorted the 49,379 accounts for which we collected full data according to the probability that an account belonged to an overt ISIS supporter. We evaluated the performance of the metrics by coding samples from the dataset using a conservative methodology for identifying visible supporters. We also weeded 5,841 accounts according to the following criteria:

• Suspended mid-collection, 90 accounts (see section 2.5.1)

• Accounts with more than 50,000 followers (see section 2.2)

(11)

1.3 Data Snapshot

Best estimate of total number of overt ISIS supporter accounts on Twitter: 46,000

Maximum estimate of ISIS supporter accounts on Twitter: 90,000

Number of accounts analyzed for demographics information: 20,000

Estimated percentage of overt ISIS supporters in demographics dataset: 93.2 percent (+/- 2.54 percent)

Period over which data was collected: October 4 through November 27, 2014, with some seed data collected in late September 2014

Top Locations of Accounts: “Islamic State,” Syria, Iraq, Saudi Arabia

Most common year accounts were created: 2014

Most common month accounts were created: September 2014

Number of accounts detected using bots and deceptive spam tactics:

6,216 using bot or spam technology for some tweets; 3,301 ac- counts were excluded from the Demographics Dataset for pri- marily sending bot or spam content

Average number of tweets per day per user: 7.3 over lifetime of ac- count, 15.5 over last 200 tweets by user

Average number of tweets per user (Over lifetime of the Account): 2,219

Average number of followers: 1,004

Smartphone usage: 69 percent Android, 30 percent iPhone, 1 percent Blackberry

(12)

Location

Figure 1: Likely ISIS supporters who sent at least one tweet out of their last 200 with location metadata enabled in the fall of 2014. Additionally, two users were located in Brazil, and one each in Indonesia and Australia.

(13)

1. Kalev Leetaru, Shaowen Wang, Guofeng Cao, Anand Padmanabhan, and Eric Shook, “Mapping the global Twit- ter heartbeat: The geography of Twitter,” First Monday, Vol. 18, No. 5–6, May 2013, http://firstmonday.org/article/

view/4366/3654; Jalal Mahmud, Jeffrey Nichols, and Clemens Drews, “ACM Transactions on Intelligent Systems and Technology (TIST),” Special Section on Urban Computing archive, Volume 5 Issue 3, September 2014, http://arxiv.org/

ftp/arxiv/papers/1403/1403.2345.pdf.

One of the most immediately interesting and important questions about ISIS’s online supporter base is where users are located.

Using open source means, the only totally reliable method of geo-locating users is to obtain coordinates provided when a user has enabled the location feature on his or her smartphone (usually re- solving to a GPS signal or a cell phone tower). We analyzed only the most recent coordinate provided by each user.

Unsurprisingly, very few users in the dataset opted to enable coordinates; the number who did was sur- prisingly high given the operational security impli- cations. Confirmed ISIS supporters used location services less frequently than non ISIS-supporting, typical users, but not dramatically less.

Out of the 20,000 users in the Demographics Da- taset, 292 had enabled location on at least one tweet out of their last 200, or 1.5 percent. By way of comparison, a 2013 study of Twitter activity found that on a typical day in 2012, 2.02 percent of all users had location data enabled, a figure that has steadily increased over time.¹ For the entire Census Dataset of 43,538 accounts, the figure was 3 percent.

The largest cluster of location-enabled accounts (28 percent) was found in Iraq and Syria, mostly in areas either controlled or contested by ISIS. More than twice as many users reported coordinates in Syria than Iraq. The next most common location was Saudi Arabia, with 27 percent. After Syria, Iraq, and Saudi Arabia, no single country represented more than 6 percent of the total.

None of the location-enabled users were based in the United States; Western countries showed only single-digit totals (e.g., three accounts in France;

two in Brazil; on in the United Kingdom; one in Australia; one in Belgium).

In January 2015, a user presenting himself as an ISIS supporter was observed using a detectable app to create tweets associated with falsified GPS coordinates for Mosul. While we cannot rule out the possibility of such tactics within the accounts ex- amined in this paper, we did not observe evidence of their widespread use.

ISIS documents circulated on paper in Iraq, and later posted to social media, indicated that the organization’s leadership was deeply concerned about the use of smartphone GPS location by its supporters and members on the ground.

In mid-December 2014, ISIS ordered members to disable GPS on their mobile devices within one month, warning that violators would have their phones confiscated and destroyed. In early January, we collected a fresh sample of tweets from a similar group of users which suggested this guidance had thus far been widely disregarded.

Because so few users (statistically speaking) had enabled location, we also analyzed location using a number of different data points provided by accounts. These locations reflect information the users chose to share, and may be deliberately misleading (in some cases demonstrably so). There were other complications as well, detailed below.

(14)

Our efforts to infer location using a combination of these factors were complicated by the erratic patterns of data entry in the fields by users, as well as the various languages in the data set. In all permu- tations of the analysis, locations of Iraq, Syria, and

“Islamic State” were dominant.

Since locations are free-form text fields, we used a third-party algorithm to resolve entries to the country level. The list of locations that resolved to the United States was extremely noisy, including entries such as “Earth,” “everywhere,” “in the kitchen mak- ing a sandwich,” and “wherever the plane’s taking me.” However, some American cities were specified, primarily New York and Washington, D.C.

Most locations could not be verified, and none of the location-enabled users were based in the United States. We are reasonably certain some ISIS supporters deceptively listed locations in the United States in order to create the appearance of a homeland threat.

Nevertheless, the location field was the only method that produced a confidence-inspiring re- In addition to GPS coordinates, there are a number

of ways to infer a user’s location based on information the user has provided. Each of these comes with a tradeoff, usually in the form of more data versus higher quality data.

Aside from location-enabled data and the content of tweets—deemed too noisy to be reliable—users can provide information about their location in the following formats:

• The “location” field on their Twitter profile. Users can enter several words in the field with no re- striction on content; for example, they can offer jokes or non-relevant information.

• Time zone: Users can select whatever time zone they want. Because the selected time zone influ- ences the time of tweets appear on a user’s time- line, there is motivation to enter it correctly, although many users do not.

• The “Bio” field in their Twitter profile, where users can write 160 characters of descriptive text on whatever subject they like, usually about themselves.

Inferred Location

Figure 2: Top locations claimed by users; users listing “Islamic State” were distributed between Syria and Iraq at a ratio equivalent to the distribution seen in location-enabled tweets.

866

Saudi Arabia

507

Syria

453

Iraq

404

United States

326

Egypt 300

Kuwait 203

Turkey 162

Pales- tinian Territory

141

Lebanon 139

United Kingdom

125

Tunisia

Location Claimed in Profile

(15)

enabled findings. Another 866 accounts claimed Saudi Arabia as a location.

With the exception of the United States, the top 20 countries correlated to regions where ISIS enjoys substantial support, such as Egypt, Tunisia, Libya, Yemen, and Gaza.²

note that the name of the city listed in a time zone may not reflect the actual location of the user, even if the user is in that time zone.

Location-enabled users entered both time zones and locations that did not match their actual locations. For instance, within the Census Dataset of more than 43,000, only 20 users provided all of the following: a claimed location, a time zone, and a location-enabled coordinate. All 20 of those users misrepresented their claimed location relative to the location provided by GPS.

Considerably more users designated their location as being in the Baghdad time zone than specified Baghdad as their actual time zone. It is possible that users outside that region are more willing to disclose their time zone; however, the sult. Accounts that provided information in the

location field resolved to 107 countries, with 960 accounts concentrated in Iraq and Syria. Users who listed “Islamic State” as their location were considered to be in either Syria or Iraq, and we assigned them to one or the other following the two-to-one distribution noted in the location-

Within the Demographics Dataset, 6,546 users opted to specify a time zone. The most frequently listed were Baghdad, 31 percent; Kyiv, 12 percent;

Athens, 10 percent; and Riyadh, 5 percent. As previously noted, a notable number of users listed Arizona and Hawaii as their time zone; combined, these accounted for 6.3 percent.

Athens and Kyiv share a time zone adjacent to the Baghdad time zone and encompasses portions of Turkey and Syria, including parts of Syria where ISIS maintains a heavy presence, such as in the group’s de facto capital in Raqqa, Syria. Since Twitter does not offer a time zone selection that names a Syrian city, these entries likely reflect users in those locations.

There was a significant disparity between the stated locations and time zones of users. It is important to

Figure 3: Time zones selected by users

2. Aaron Zelin, “The Islamic State’s Model,” Washington Post, 28 January 2015, http://www.washingtonpost.com/blogs/mon- key-cage/wp/2015/01/28/the-islamic-states-model/.

1977

Baghdad 761

Kyiv

615

Athens 310

Riyadh

296

Amster- dam

285

Ljubljana 246

Casa- blanca

234

Hawaii

180

Arizona 180

London

Top Time Zones

(16)

3. For example, the site’s design flips to the right or left depending on whether a user selects Arabic or English.

4. “Foreign Fighters in Iraq and Syria,” Radio Free Europe/Radio Liberty, 29 January 2015, www.rferl.org/contentinfographics/

infographics/26584940.html.

5. Ashwin Shehagiri, “The Languages of Twitter Users,” New York Times, 9 March 2014, http://bits.blogs.nytimes.

com/2014/03/09/the-languages-of-twitter-users/?_r=0.

to 3 percent who selected Arabic. The trend of Twitter adoption by Arabic users from 2011 to 2013 suggests this number probably increased sharply in 2014.⁵

As far as content, many users tweeted in more than one language, sometimes as part of ISIS social media strategies to direct messages at external target audi- ences, such as when it publicizes the beheadings of Western hostages. Tweets also frequently featured a mix of languages, such as English hashtags attached to Arabic content.

users who listed Islamic State as their location, which may be meant as a show of support rather than a disclosure.

The vast majority of users listing Baghdad as their time zone entered a location that was metaphori- cal or unclear; 42 percent stated they were either in Iraq or Syria, with many listing their location simply as the Islamic State.

1.5 Languages

Twitter offers data on what language a user selected when completing his or her profile information. The choice of language is important to the process of navigating the website—for example to read menus and settings—and also dictates where such features will appear on the page.³ User language selection does not necessarily correlate to the language used in tweets. Multilingual users might choose to navigate the site in a second language, if they are adequately proficient.

Language data was available for more than 18,000 members of the Demographics Dataset, excluding some accounts which were suspended or otherwise changed status before data could be collected.

Among those users, 73 percent selected Arabic, 18 percent selected English, and 6 percent selected French, a finding that tracks to some extent with the distribution of Western foreign fighters,⁴ with an overemphasis on English that also likely reflects ISIS’s target audience in the United States for inciting and harassing propaganda. No other language comprised more than 1 percent of the total.

In a 2013 study of typical Twitter users who selected a language preference, 51 percent chose

(17)

1394

ReferenceISIS 293

Syrian

289

Immigrant 277

Ansari

211

Stranger 178

Iraqi

140

Baqiyah 127

Jazrawi 116

Baghdadi 110

Tunisian

Arabic Words in Display Names

6. Ellie Hall, “Inside The Chilling Online World Of The Women Of ISIS,” BuzzFeed, 11 September 2014, http://www.buzzfeed.

com/ellievhall/inside-the-online-world-of-the-women-of-isis#.tj0p38MZL.

1.6 Display Names

Twitter users identify themselves in two primary ways.

The first is through the selection of a user handle (“@johndoe”), and the second is through the selection of a display name on the profile page, such as “John Doe,” although the display name can consist of any words or symbols up to 20 characters in length.

Despite a wide range of individual variation, some trends in the selection of display names were detected.

The only powerful trend involved identification with the Islamic State in a broad sense using terms such as Dawla (Arabic for “state,” used as a shortened name for “Islamic State”), baqiyah (an ISIS slogan), Shami (Arabic for Syrian) and references to the caliphate.

These terms were overwhelmingly more frequent than virtually any other words used in display names.

Similar to location information, user display names in the Demographics Dataset were subject to misdi- rection and confusion. However, some markers were commonly used to highlight foreign fighters: muhajir,

“immigrant”, and ghuraba’, “strangers.” One of those two words appeared in a total of 500 user profiles.

References to nationalities suggested an even larger number of foreign fighters in the set.

Within the top 20,000 users, 239 accounts were observed to use the Arabic words umm (mother) or bint (girl or daughter) in their handles or display names to indicate that they were female. In con- trast, 4,536 users used the Arabic word abu in their handles or display names, claiming a male identity.

Other gender indicators were used in names, but the complexity of navigating multiple languages and naming conventions to produce a credible result with directly comparable terms for men and women exceeded the time available for this study.

However, a third-party tool relying on opaque criteria estimated approximately seven men for every one woman in the network. Additional research would provide better insight into this question.

Earlier in 2014, nearly 500 accounts identifying themselves as umm or bint were detected during an unpublished research experiment by J.M. Berger, which specifically sought to identify female supporters of ISIS. In this study, male and female social networks were observed to be segregated to some extent, often at the explicit urging of both male and female ISIS supporters, which may have also influenced the results.⁶

Figure 4: Most common Arabic words entered by users in the “display name” field

(18)

Date of Account Creation

As seen in figures 5 and 6, an extremely large number (23 percent) of ISIS-supporting accounts were created in 2014; accounts showed the most activity in September of that year. Collection of user information ended in mid-October (other

data took longer to collect); the actual total for that month would presumably have been higher had collection continued. (A differently derived comparison figure for October can be seen in section 2.5.4.)

Figure 5: Date of account creation, by year

Figure 6: Accounts created in 2014, by month 2

2008

92 2009

182 2010

1064

2011

2380

2012

4378

2013

11902

2014

Accounts Created, by Year

Accounts Created in 2014, by Month

874

Jan

694

Feb

768

Mar

708

Apr

715

May

984

Jun

998

Jul

1477

Aug

3388

Sep

1296

Oct 2014

(19)

7. Ben Popper, “Twitter’s user growth has stalled, but its business keeps improving,” The Verge, 5 February 2015, http://www.theverge.com/2015/2/5/7987501/twitter-q4-2014-earnings.

Not coincidentally, September 2014 corresponds with the time frame during which Twitter began to aggressively suspend ISIS supporters for tweeting graphic images and videos of the beheadings of Western hostages.

We believe many—perhaps most—of these accounts were created in response to the suspensions, either to replace accounts that had been taken down, or as backup accounts to hedge against future suspensions and other steps to offset ISIS’s Twitter influence. A potentially substantial number of users may have created and recreated multiple accounts during the September 2014 time frame, which were subsequently suspended.

Only 1.3 percent of all accounts were created prior to December 31, 2010. Almost 60 percent were created in 2014. This suggests that most ISIS supporters are relatively new to Twitter, or that they created new accounts to reflect a change of interest.

It is important to account for Twitter’s overall growth in the past several years; however, the growth in ISIS supporting accounts outstripped that of the overall Twitter user population. Twit- ter’s user base grew by approximately 30 percent in 2013, while ISIS’s user base nearly doubled.

The Twitter user base grew 20 percent in 2014;⁷ the number of ISIS supporters on Twitter nearly tripled during the same period (within the limits of the sample). This is reflective of strong growth, but also reflects anecdotal observations of increased adoption of social media by jihadist extremists starting in 2013.

The growth in ISIS’s online support base also broadly correlates with its growth on the ground in Iraq and Syria, and the course of its rift with and ultimate separation from al-Qa’ida. Some al-Qa’ida-supporting Twitter users may have created new accounts after this split to demonstrate their allegiance to ISIS.

Year Created

2008 2009 2010 2011 2012 2013 2014

Number of Accounts

2 92 182 1064 2380 4378 11902

At least some of the growth in the number of ISIS supporters is organic, although the spikes in the data clearly reflect considerations related to the suspension of accounts in September and Octo- ber 2014. Arguably, the spike could have exagger- ated the total estimate of supporters by as much as 20 percent. We conclude that at least some of the churn effect of accounts being created and destroyed canceled itself out.

The question of users who simultaneously maintain multiple accounts is also relevant, since some users create duplicate and backup accounts in response to being suspended. Such accounts were observed anecdotally, and most backup accounts appeared to remain relatively inactive until their predecessor accounts were suspended. Since suspensions are almost always based on the content of tweets, rather than other network characteristics, there is a strong practical argument against duplicating content in a backup account created for the express purpose of evading suspension.

Nevertheless, some users were observed using Twitter client apps that include the function (such as Hootsuite and Tweetdeck). Clear ex- amples of this behavior were relatively rare (considerably fewer than 300 accounts in the initial, unsorted Census Dataset of more than 49,000 accounts), and users consistently employing this technique were almost entirely excluded from the Demographics Dataset consistent with the rules for bots and apps (see section 3.3).

Percentage of total

0.01%

0.46%

0.91%

5.32%

11.90%

21.89%

59.51%

(20)

Date of Last Recorded Tweet

Figure 7: Date of last tweet, excluding the 83 percent of accounts that tweeted during the collection period

Collection of tweets took place from October through November 2014. The majority of tweets were collected in October, during which more than 83 percent of the accounts tweeted. Of the remaining accounts, 99.2 percent tweeted in 2014. That left only a fraction of 1 percent that had been inactive since 2013 or earlier, with the vast majority of those having tweeted in 2013. Given that ISIS, in its current incarnation, only came into existence in 2013, this is a logical finding.

The metrics that were used to identify ISIS supporters weight certain types of activity and may have influenced this data (section Sorting Metrics).

Additionally, the criteria for seed accounts (section Starting Point) also influenced the set to favor accounts that were more active.

Other factors were weighted to avoid detecting only users with visible tweets, and we believe this data accurately points toward a high level of activity among ISIS supporters. Only 44 percent of all ex- isting Twitter accounts display even a single visible

tweet,⁸ so by virtually any measure, ISIS-supporting Twitter users are far more active than ordinary users. A similarly derived analysis of 400 Al-Qa’ida in the Arabian Peninsula (AQAP) supporters, for instance, found that 34 percent had been silent since the start of 2014.⁹

A number of the accounts which had not tweeted since 2012 had clearly been active more recently, since some of them were branded with ISIS’s name established after 2013. In some cases, we discov- ered in later investigation that such accounts were actively tweeting, suggesting that some users within this small subset deleted their tweets periodically (consistent with previous observations of this activity). Others simply did not tweet publicly; 30 percent of the 1,264 accounts for which no tweet date was collected were marked private. The remainder had no tweets available for analysis at the time of collection for whatever reason.

8. Yoree Koh, “Report: 44% of Twitter Accounts Have Never Sent a Tweet,” Wall Street Journal, 11 April 2014, http://blogs.wsj.

com/digits/2014/04/11/new-data-quantifies-dearth-of-tweeters-on-twitter/.

9. Analysis generated in January 2015 using same techniques as in this study.

820

Aug

518

Jul

379

Jun

257

May

243

Apr

223

Mar

167

Feb

142

Jan

178

2013

20 2012

3 2011

Date of Last Tweet, Excluding Collection Period

2014

(21)

1.9 Avatars

ISIS supporters use a wide variety of images as identity markers on Twitter. A non-exhaustive review of Twitter profile pictures within the dataset shows that these images are most prolific among users who have 150 to 1000 followers. Smaller accounts often use the default Twitter “egg,” while larger accounts sometimes employ imagery unrelated to ISIS—perhaps meant to hedge against suspension by Twitter. Within the Demographics Dataset, 6.5 percent of accounts used the default profile picture.

Images were reviewed manually rather than pro- grammatically, although such an approach could be the basis of future research. Anecdotally, the most common profile picture was easily the iconic black and white flag used by ISIS in its official documents and propaganda, and liberally displayed in territories ISIS controls. The next most commonly-used imagery involved variations on pictures of ISIS’s leader, Abu Bakr al-Baghdadi.

Al-Qa’ida founder Osama bin Laden and al- Qa’ida in Iraq founder Abu Musab al Zarqawi were also well-represented, along with prominent ISIS members such as “Jihadi John.” Us- ers also displayed figures less known to outsiders, such as Abu Abed Abdul Rahman al-Bilawi, who was killed while playing a key role in ISIS’s June 2014 attack on Mosul, Iraq.

Users can also select a background picture to run in a banner size across the top of their Twit- ter profile page. These were less consistent than profile pictures. Images often included fanciful depictions of the Islamic State, such as fighters on horseback carrying ISIS’s flag, airliners and buildings festooned with the flag, or in one case, a large sailing ship with the flag as its main sail.

Other popular background images included scenes from ISIS video productions.

Figure 8: Typical Twitter profile pictures used by ISIS supporters include variations on the flag used by ISIS, im- ages of al Qaeda founder Osama bin Laden, and prominent ISIS members and leaders including “Jihadi John” and Abu Bakr al Baghdadi.

(22)

10. J.M. Berger, “Resistible Force Meets Movable Object,” Intelwire, 2 October 2014, http://news.intelwire.com/2014/10/resist- able-force-meets-movable-object.html.

Top Hashtags

We collected each user’s 200 most recent tweets. A total of 5,384,892 tweets were analyzed, containing 100,767 unique hashtags used a total of 1,465,749 times, which is an average of once every 3.7 tweets.

At least 151,617 hashtags that included one of four most-common variations on the spelling of

“Islamic State” in Arabic were detected (all of the variations could not be fully accounted for), representing 2.8 percent of all tweets.

No other hashtags even came close to that rate of usage. The next most common hashtag was the Arabic word for “urgent,” which was liberally appended to news out of Syria and Iraq; this appeared in 24,275 tweets, or less than 0.5 percent of all tweets. The word “Syria” in both Arabic and English was slightly lower, with 23,769 tweets.

A breakdown of the top 100 hashtags found that 26 percent consisted of the “Islamic State” hashtag in its four most common variations. “Urgent” and Syria represented about 4 percent each.

In fourth place—representing 3 percent of the top 100 but only 1.2 percent of all hashtags—was “Da’ish,” the

Arabic acronym for ISIS that is generally viewed as a derogatory term. The hashtag’s presence reflected negative content about ISIS from non-responsive accounts in the dataset, retweets of content critical of ISIS that supporters wished to respond to, and a relatively small but notable group of users using the hashtag to send pro-ISIS messages to ISIS critics, or to reclaim the term in a positive light.

Within the top 100 hashtags, we categorized all general references to ISIS or the caliphate, all references to Syria and all references to Da’ish, as well as all hashtags pertaining to the suspension of ISIS- supporting accounts and the announcement of re- placement accounts.

ISIS references represented 40 percent of the top 100 hashtags. Hashtags used in reference to Twitter suspensions were second, with 9 percent.

This figure accords with previous research by J.M. Berger based an analysis of approximately 3,000 tweets sent from September 29 to October 1 of 2014, which found that at least 8 percent of ISIS tweets sent during that period pertained to account suspensions.¹⁰

Figure 9: Number of tweets containing a hashtag, consolidated by theme from among the top 100 hashtags 18129

Iraq 20485

Daash References 24275

Urgent 27583

Syria References 51174

Suspension- Related 232728

Top Hashtags

ISIS References

(23)

1.11 Top Links

Tracking the external content (such as links to propaganda) sent by ISIS Twitter accounts forms an obviously important function. However, we could not satisfactorily resolve this during the course of this study, due to a number of complications. We therefore recommend further research on the topic.

The calculation of most-linked content was complicated by a number of factors, most importantly Twitter’s URL shortening practices and the removal of ISIS content by third-party Internet service providers such as YouTube.

Twitter employs URL-shortening to allow users to send links to content without exceeding the 140-char- acter limit for a tweet. When a full-length URL (such as www.youtube.com/watch?v=h77URBgDRlc&feat ure=youtu.be) is entered by the user, it is shortened to take up fewer characters (such as youtu.be/h77UR- BgDRlc). Twitter keeps track of shortened URLs by shortening them further for internal use, rendering them all under the domain t.co (t.co/KcEfbPiWgc).

We detected 2,149,327 shortened URLs in the set of 5,384,892 tweets, or one URL for every 2.5 tweets. There were more than 1.5 million unique shortened URLs, but since multiple shortened URLs can point to the same target URL, we are certain that fewer unique web pages were linked. We were unable to resolve this question in more detail.

Expanding these URLs after the fact was prob- lematic. Some users shortened a URL before entering it into Twitter, so expanding the t.co URL only points to another shortened URL.

If Twitter deems content to be a violation of its terms of service, the t.co link will simply stop functioning.

Of the unique t.co URLs, 689 were tweeted more than 100 times, with the first-ranked URL being tweeted only 846 times. Many of the URLs were malformed, meaning the t.co URL could not be extracted accurately from the text. We attempted to expand the top 20 unique URLs to discover the content they pointed to, with the following results shown in the table below:

Shortened URL

http://t.co/wdrKsuc5fd http://t.co/Fh1Y73OyEX Malformed URL Malformed URL http://t.co/H6uUirXBD9 Malformed URL

http://t.co/kPcWorCHG8 http://t.co/m2azV15Yyu http://t.co/

http://t.co/mFywYHZp http://t.co/PygkTd7N2n Malformed URL http://t.co/QsnbwSlLwE http://t.co/pbKMmJEnTH Malformed URL

Malformed URL http://t.co/Pr6pl1Gs1Z Malformed URL Malformed URL Malformed URL

Expanded URL

http://retweetcom.com/ret

http://twitter.com/by3_S/status/519152478433345536/photo/1 Expansion failed

Expansion failed

http://retweetcom.com/ret Expansion failed

http://twitter.com/ilyass_4/status/519149486795272192/photo/1 http://twitter.com/Fighter_Otaibi/status/521357691491336192/photo/1 Content removed due to personal identification

Expansion failed http://rt10.a77mad.com Expansion failed http://topretweet.com/

http://twitter.com/ilyass_4/status/519149486795272192/photo/1 Expansion failed

Expansion failed http://cutt.us/fnzQF Expansion failed Expansion failed Expansion failed

(24)

which we could resolve a target page pointed to a single page that could not be loaded at the time of writing, on a domain that could also not be loaded.

The domain’s name, Retweetcom.com, obviously suggests it is a Twitter app for manufacturing arti- ficially inflated retweets, consistent with manipulative tactics observed to be used by ISIS supporters on social media, and nearly 3,000 tweets in the dataset were attributed to the site’s Twitter app. The expanded URLs ranked 11th and 13th pointed to similar spam-like services.

One t.co URL pointed to another URL shortening services (cutt.us), which led to yet another URL shortening services that required a login.

Of the remaining URLs, four pointed to tweets containing photos. Three of the accounts linked had been suspended; the fourth pertained to an ill child in Syria, and not ISIS. The picture was no longer available, although the text of the tweet remained; it had been retweeted 46,000 times. Because the individual was not linked to ISIS and provided person- ally identifying information on his account, we have removed the URL of the linked tweet.

(25)

Twitter sporadically suspended ISIS’s primary official account throughout 2014, before taking a more aggressive stand starting in summer 2014, when it increasingly suspended most official accounts including media outlets, regional hubs, and well-known members. ISIS briefly experi- mented with transferring its official accounts to other social media services, where it was also met with repeated suspensions.

Although ISIS’s public, official accounts have more or less been eliminated, it has adopted coping mechanisms to maintain control over information flow on Twitter.

Specifically, its official social media operatives have established small accounts, some of which fly under the radar, while others are periodically suspended and regenerated. These users are responsible for uploading ISIS content to file-sharing and video

web sites, and then publishing links to the content.

Other users (known as the mujtahidun, and dis- cussed further in section 2.1) then disseminate the links more widely.

As of January 2015, ISIS had reconstituted its regional accounts with strong privacy settings, allowing only a small group of known ISIS supporters to follow the accounts and read their tweets. The content of the tweets—primarily news releases, videos and photos from ISIS’s various provinces—are then disseminated by a number of other smaller accounts using hashtags. Af- ter the initial dissemination, the content is more widely distributed, but at significantly reduced levels from early 2014.

As of December 28, 2014, we had detected 79 such

“official” accounts, mostly through specific investigation and manual search, rather than via the Cen-

Figure 10: Network relationships among “official” ISIS accounts as of January 3, 2014

1.12 “Official” Accounts

(26)

count’s last 200 tweets.

The private accounts averaged 150 followers each, and many used the default Twitter “egg” profile picture in order to maintain a lower profile. The regional accounts were mostly marked private, although some were seen to switch to public tweets at times, and they were connected to other private accounts that appear to be an essential part of the functioning of the semi-official account network.

sends out the content. These services also typi- cally rely on bots and apps to do their work.

Some apps, such as Hootsuite and Tweetbot, are simply Twitter clients that allow users to tweet and follow others, and may not include manipulative features. We eliminated the most popular clients from the list and focused on non-client apps.

Some apps are apparently devotional in nature, tweeting prayers, religious aphorisms, and content counts from the Census Dataset were added to the

list after examination. Of the 79 accounts, 24 had designated their tweets and follower lists as private.

We were nevertheless able to gather some information through various analytical approaches.

The public accounts had an average of about 6,437 followers each, although fresh suspensions reduced that number within just a few days. These accounts tweeted an average of 11 times per day over their

ISIS supporters use a wide variety of bots and apps for many different purposes.

Bots and apps are small pieces of computer soft- ware or third-party services designed to promote content from a Twitter account automatically, without a human being manually sending tweets.

A wide variety of bot and app techniques were observed in the collected data. Spam services sell tweets and retweets of selected content. A user purchases tweets from the seller, then the seller

1.13 Bots and Apps

Figure 11: Top non-client apps used to send tweets by members of the Demographics Dataset, by number of tweets sent

50963

knzmuslim

49097

quran.ksu.

edu.sa

46985

unknown app

44833

du3a.org

30981

twitquran.com

26343

twitterfeed .com

24547

qurani.tv

Tweets Sent by Apps

(27)

11. J.M. Berger, “How ISIS Games Twitter,” The Atlantic, 16 June 2014, http://www.theatlantic.com/international/archive/2014/06/isis-iraq-twitter-social-media-strategy/372856/.

from the Quran, although they may also serve as identity markers or fulfill some kind of signal- ing function. These apps, such as knzmuslim and du3a, can produce staggering numbers of tweets per day. Knzmuslim was clocked at more than one million tweets per day, and around 1,000 tweets per minute, at one point in early January. The content they post does not overtly pertain to ISIS.

In addition to their wide popularity both within and outside of ISIS circles, these apps introduce noise into social networks and their use may be intended to impede analysis.

Some apps, such as BufferApp, are used to schedule tweets to be sent at a particular time, and do not necessarily denote manipulative behavior. A number of similar commercial social media marketing tools, including some used by ordinary businesses and brands, were detected.

Other apps are intended to disseminate ISIS propaganda at a pace and volume that enables their wider distribution. The most successful of these was known as the “Dawn of Good Tidings.” In mid- 2014, thousands of accounts signed up for the app, which was endorsed by top ISIS online personali- ties. At its peak, it sent tens of thousands of tweets per day. The app was terminated by Twitter in June 2014, silencing thousands of ISIS-supporting accounts overnight.¹¹

In the wake of that setback, ISIS supporters have responded by creating a large number of bots in small clusters, with each cluster using a different service to post tweets of the propaganda and hashtags it wishes to promote. If one “family” of bots is suspended, there are still many others that will continue to tweet. Thousands of such accounts were detected in the course of this analysis. Many from this new generation of bots were constructed using popular third party automation services such as IFTT (If This, Then That), which Twitter is un- likely to shut down since it is much more commonly used for innocuous purposes by ordinary users.

Because a deceptive app can function alongside a human operator of a Twitter account (sending tweets automatically while still allowing the user to tweet normally), we did not filter out all of the apps and bots we detected. In some cases, the app did not represent the majority of the content tweeted by the account. In other cases, apps were deter- mined to be legitimate Twitter clients, rather than manipulation devices. We eliminated some known bot and spam providers, as well as accounts whose tweets were identical to tweets posted by other users in large volumes. In some cases, we evaluated the percentage of a user’s tweets that were sent by the app as opposed to other clients. We also reviewed technical signatures related to bot activity.

In the overall Census Dataset, around 400 non- client apps were detected to be in use among more than 6,000 accounts. Within the 5.4 million De- mographics Dataset tweets analyzed, hundreds of additional bots and apps were also detected operat- ing at lower volumes, enough to suggest that perhaps 20 percent or more of all tweets in the set were created using bots or apps.

Any given Twitter account can include tweets from both an app and a human user. We eliminated just over 3,000 accounts from the Census Dataset for very high levels of bot and spam activity, prior to creating the Demographics Dataset (section Bot and Spam Detection). In early 2015, we checked activity within the Demographics Dataset and dis- covered about 400 accounts that met the criteria used to exclude bots in the first collection. These accounts had changed their patterns of activity since the original collection.

(28)

Smartphones

Each tweet collected specified what type of Twitter client was used to send the tweet, meaning whether it was sent from the Twitter web site or a smartphone client.

For each user, we collected the name and download link for the client they employed most frequently. We broke these down according to whether the download link pointed to the Google Play store, the Apple store, or Blackberry.com. A number of other mobile clients were used, far smaller numbers, such as an app exclu- sive to Lenovo phones.

Among users of the three most popular phone types, 69 percent had downloaded a Twitter client from the Google Play story or Google.com.

Another 30 percent used a client downloaded from the Apple iTunes store, and about 1 percent had downloaded a client from Blackberry.com.

In mid-December, ISIS announced it would ban iPhone products within its territory due to se-

curity concerns. In early February, we collected data on a set of 10,000 likely ISIS-supporting accounts using a similar methodology to the overall study, and found only a 1 percent drop in the use of iPhones.

Figure 12: Smartphone usage among ISIS supporters, according to primary app used for tweeting

Smartphone Usage

30%

1%

69%

Android Apple Blackberry

(29)

2. Social Media Metrics

In addition to information that reflects user pref- erences and location, the most basic Twitter metrics—the number of followers and following, and patterns of tweeting—was analyzed to determine the profile of a typical ISIS supporter account, and understand some characteristics of the overall network and its potential reach.

(30)

than one tweet per day on average. Only 2.4 percent of accounts tweeted more than 50 times per day on average. A typical account tweeted 7.3 times per day, for an average daily output of 133,422 tweets per day from all members. This total output figure comes with several caveats.

These tweet-per-day averages allow for long pe- riods during which users do not tweet. For example, a user could open an account and tweet 70 times on Monday, then stop tweeting for the rest of the week. His average would be 10 tweets per day for the week.

Overall, ISIS supporters were much more active than the average Twitter user. In the December sample, 35 percent of users had tweeted within the 24 hours preceding the collection of data, and another 16 percent had tweeted within the preceding seven days. Within the year preceding collection, 98 percent of users had tweeted at least once, considerably higher than the 67 percent of all active Twitter users who had tweeted The nature of the process we used to evaluate

tweets, while important to developing the metrics used to evaluate the accounts, limited evaluation of some aspects of a user’s activity (especially for prolific users who tweeted at a high pace).

Therefore we evaluated tweeting patterns using two sets of data:

• Data collected for the study that analyzed activity based on the user’s most recent 200 tweets. This helped us identify users who might not tweet every day or week, but who are very active when they are online.

• Data based on more than 18,000 accounts active in late December under the same user- names were identified in the initial collection of data. These figures reflected activity over the lifetime of the account.

Over the lifetime of their accounts, about 69 percent of ISIS supporters sent fewer than five tweets per day on average, with 40 percent sending less

Figure 13: Tweets per day, calculated from each user’s 200 most recent tweets

Tweeting patterns

18425

0–50

817 50–100

213 100–150

545 150–200

Tweets Per Day on Average

(31)

12. David Murphy, “44 Percent of Twitter Accounts Have Never Tweeted,” PC Magazine, 13 April 2014, http://www.pcmag.com/

article2/0,2817,2456489,00.asp.

within the previous year. 62 percent of ISIS supporters had tweeted within 30 days of collection, compared to just 13 percent of all Twitter users.¹² The lifetime averages, while useful, do not adequately portray user activity patterns. The most active accounts are also the most likely to be suspended (as discussed in section 2.5.1). Because of this, the December sample omitted some of the most active accounts from analysis. Further- more, some users whose past activity was measured at a high rate had subsequently deleted all their tweets. Both of these factors shaped the late December dataset by removing data on the most prolific users.

As discussed elsewhere in this report, ISIS supporters have been observed to tweet repeatedly in short bursts in order to widely disseminate important content. Insight into this activity can be found in the original collection, which analyzed the most recent 200 tweets from each account and calculated tweets per day based on the time of the earliest collected tweet and the latest collected tweet.

This approach allowed us to detect users who tweeted in prolonged bursts, even if they later went silent for a period of time. Since only 200 tweets were collected for each user, the maximum value recorded in the dataset was 200 tweets per day, even though some users were observed to tweet more on specific days.

An overwhelming majority of users (92 percent) tweeted less than 50 times per day, including 500 accounts whose tweets were marked private and for whom no tweets were collected. However, 1,575 users tweeted more than 50 times per day on average, with 545 tweeting more than 150 times per day.

These prolific users—referred to in ISIS social media strategy documents as the mujtahidun (in-

dustrious ones)—form the highly engaged core of ISIS’s social media machine. These users may not tweet every day, but when they do, they tweet a lot of content in a very short amount of time.

This activity, more than any other, drives the success of ISIS’s efforts to promulgate its message on social media. Short, prolonged bursts of activity cause hashtags to trend, resulting in third-party aggregation and insertion of tweeted content into search results. Prior to the start of Twitter’s aggressive account suspensions, highly organized activity among the mujtahidun—who at one point we may have numbered as many as 3,000, including bots—allowed ISIS to dominate certain hashtags and project its material outside of its own social network to harass and intimidate outsiders, as well as to attract potential recruits (this is discussed at more length in section 4).

Within the entire Demographics Dataset, the average user tweeted 15.6 times per day when measured by their most recent 200 tweets, twice as high as the figure calculated over the lifetime of the accounts.

Because of the 200-tweet cap on data, this estimate is certainly lower than the reality.

Since this figure reflects the most recent tweets of each user, it is capped at 200 tweets per day, is not delimited by date, and it cannot be used to extrapolate total daily volume; it does, however, clearly indicate that when users are online, they are extremely active.